40+ Cybersecurity Statistics Every Business Should Know (2026)

Average cost of a data breach globally in 2024, up 10% from the previous year.

Average cost of a phishing-initiated data breach — the most expensive initial attack vector.

Average cost per stolen intellectual property record in a data breach — up 11% from the prior year.

Average data breach lifecycle (identify + contain) — a 7-year low, down from 277 days the prior year.

Average cost savings when AI and automation are extensively used in prevention workflows.

Of small businesses that suffer a cyber attack go out of business within six months.

Average data breach cost for organizations with fewer than 500 employees.

Average cost savings for organizations that had an incident response plan and team in place.

Total cybercrime losses reported to the FBI Internet Crime Complaint Center in 2023.

Of cyber attacks target small businesses.

Of breaches involved a non-malicious human element (social engineering or errors).

Of all data breaches involved phishing.

Average number of cyber attacks detected daily.

Emails sent is a phishing attempt.

Of cyber attacks begin with a phishing email.

Of breaches involved a third party or supply chain compromise — up 68% from the prior year.

Increase in exploitation of vulnerabilities as an initial access vector (from 2023 to 2024).

Average cost of recovering from a ransomware attack (excluding the ransom payment) — up 50% from $1.82M in 2023.

Of organizations were hit by ransomware in the past year.

Of organizations that had data encrypted paid the ransom — the first time more than half of victims paid.

Median ransom payment in 2024, a 5x increase from $400K in 2023.

Of ransomware victims took more than a month to recover.

Of all cyber breaches impact businesses with fewer than 1,000 employees.

Of small businesses have no cybersecurity measures in place.

Of small businesses have customer data that could be compromised in an attack.

Average cost of a cyber attack for a small business.

Of small businesses rate their ability to mitigate cyber risks as highly effective.

Of SMBs were the target of a cyberattack in the past year.

Of small businesses take 24+ hours to recover from a cyber attack — and some never fully recover.

Average cost of a healthcare data breach — the highest of any industry for the 14th consecutive year.

Of hacking-related breaches used stolen and/or weak passwords.

Of people use the same password everywhere.

Of passwords can be cracked in under one minute.

Username/password combinations available on the dark web.

Of organizations experienced at least one cyber event driven by a compliance gap in the past year.

Average HIPAA violation fine levied by HHS Office for Civil Rights.

Increase in cyber insurance premiums over the past 3 years due to rising claims.

Of automated credential attacks are blocked by multi-factor authentication (MFA).

Organizations with security awareness training experience 12x fewer successful phishing attacks.

Of cyber insurance claims are denied due to failure to meet policy security requirements.